What LinkedIn Could Learn From OKCupid and Others | Hacker News Reader

What LinkedIn Could Learn From OKCupid and Others

iamvictorio.us

37 pointswretched13 comments

Something Linkedin ought to be taken to task for (Which they continue to get away with) -- phishing:

Linkedin will show you a login-like screen with your email address pre-populated and a password prompt. Two dangerous things can happen: 1) a user can absent-mindedly assume they're at their email login page and type in their email password (less likely) 2) a user can absent-mindedly assume that this is the Linkedin login page and type in their Linkedin password.

The problem with (1) (and 2 if your email password is the same as your linkedin password) is that you've just given Linkedin access to your email contact list. Then Linkedin can shoot an email to all your contacts letting them know you're on Linkedin / etc.

To me this is a form of phishing that countless less-tech-savvy folks are getting caught up in and should not be OKAY in the industry.

I'm almost certain LinkedIn doesn't try to use your username/password you use for the site to access your email. Triggering millions of password failures on gmail/yahoo/etc. is not something that they would risk.

During signup, if you are on one of the major webmail services, it will explicitly ask you to authorize yourself on them so it can get your contacts however.

Having worked there and specifically as product manager for the Who Viewed My Profile portion, I can tell you that they take privacy very seriously.

That's not what the OP said. Linkedin presents a form on the front page after you're logged in that specifically asks you to enter your password so that you can search your e-mail contacts.

But many people might interpret that as a LinkedIn log-in form (not realizing that they are already logged in). If LinkedIn just had an ad there asking people to click a button to then fill out their e-mail address/password, they would likely have much fewer people let LinkedIn look at their e-mail account.

This is much more legit than just trying the Linkedin account username/password to access the e-mail account, but it is still a form of phishing.

No it explicitly asks if you'd like Linkedin to search your email contacts by filling out the email address and password fields below. It pre-populates the email address from your linkedin email login address. Thus without reading what the fields are for, it's very easy to assume you've simply been logged out of Linkedin and need to re-log-in. Upon doing so Linkedin will try one time to login to your email (Gmail and other web email clients do this too -- to grab contacts from older email accounts but they don't use this phishing-style approach). If your email password happens to be your Linkedin password, Linkedin will have access to your email contacts without you realizing it. And more embarrassing: Linkedin may send an email to your contacts mentioning you (they used to do this, maybe not as much anymore). Don't you remember getting all those Linkedin invite emails from your 'friends'? how do you think those got sent? Do you really think your friends intentionally typed in your email address so Linkedin could spam you?

Notifying users when their profile is viewed is crazy for anything other than a dating site, where these notifications simulate the real life mating ritual of coyly expressing interest in someone. I'm not a huge privacy freak, but I don't want anyone on any other network to know I've viewed their profile unless I take a specific action or opt in.

Likewise, encouraging "random friends" would degrade the value of LinkedIn's network. Part of its current value is that your "connections" presumably have a real link (work history or friendship) with all of their "connections" and can potentially make a worthwhile recommendation or introduction. This goes away if randomness is introduced.

Dating sites are barely social networks - they exist to facilitate quick one-on-one interactions - so social networks should copy their features with extreme caution.

Yep. I never click on website profiles when I know that the person can see the visits. The good thing about LinkedIn is you can turn that off, but even then, I notice it adds the person to the suggested users list after a month or so (I wonder if it adds me to their suggested list?).

There's lots of reasons why I don't want people to know. Like for example, a friend works at company x, so every so often I look at other employee profiles at company x to see if he joined LinkedIn (and is therefore in their connections).

Just harmless stuff like that, which might look sinister to someone who doesn't know the context.

With my experience, LinkedIn will say that you are an anonymous user or give me a list of 15 people to guess who you are. I also don't think the people recommendations algorithm includes whose profile you visit.

with a paid account the information is a lot more detailed and definitely identifies specific people.

I have a paid account. It only identifies specific people if those people allow that.

I only just started using LinkedIn. One of the major problems I've always had with the service was the fact that it would notify you that someone from some area had viewed your profile. This is a major intrusion into the seclusion of my visitors' browsing activities for several reasons, but most of all because you have no control over what might be inferred by this view.

I think this is an alarming trend on social networking sites. As saturdaysaint already pointed out, this is okay for dating web sites, because the point of them is to encourage pairings between members. Social networks, like facebook, and professional networks, like LinkedIn, have grown to the point where they are virtual address books containing more than just information about your contacts, but up to date information about the activities and interests that they choose to disclose.

Product management teams need to tread carefully when introducing features that go against the grain of real-life interaction. To me, page view notifications are the virtual equivalent of a little voice alerting you whenever someone has mentioned your name in conversation. Absent of context, what could you rationally infer from this notification? Context is key, and without delivering that, the notice is at best worthless and at worst dangerous.

You can switch this off in the preferences.

Ah, thank you, I wasn't even aware. It nevertheless should be something that's an opt-in feature, rather than an opt-out annoyance.

My LinkedIn rant:

A year ago LinkedIn released the "Publications" section for your profile: http://blog.linkedin.com/2010/10/18/linkedin-profile-section...

Now you can list your academic papers on your profile, awesome. The problem being that YOU are listed in the "first author" position on any paper you submit. Author-order being very important, this is a major issue that should have been caught in the spec stage. It hasn't been fixed in over a year.

Reply on news.ycombinator.com